Changeset 220289 in webkit
- Timestamp:
- Aug 4, 2017 1:42:43 PM (7 years ago)
- Location:
- trunk
- Files:
-
- 2 added
- 3 edited
Legend:
- Unmodified
- Added
- Removed
-
trunk/LayoutTests/ChangeLog
r220285 r220289 1 2017-08-04 Said Abou-Hallawa <sabouhallawa@apple.com> 2 3 RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available 4 https://bugs.webkit.org/show_bug.cgi?id=174874 5 <rdar://problem/33530130> 6 7 Reviewed by Simon Fraser. 8 9 * fast/images/image-element-image-content-data-expected.txt: Added. 10 * fast/images/image-element-image-content-data.html: Added. 11 1 12 2017-08-04 Matt Lewis <jlewis3@apple.com> 2 13 -
trunk/Source/WebCore/ChangeLog
r220288 r220289 1 2017-08-04 Said Abou-Hallawa <sabouhallawa@apple.com> 2 3 RenderImageResourceStyleImage::image() should return the nullImage() if the image is not available 4 https://bugs.webkit.org/show_bug.cgi?id=174874 5 <rdar://problem/33530130> 6 7 Reviewed by Simon Fraser. 8 9 If an <img> element has a non-CachedImage content data, e.g. -webkit-named-image, 10 RenderImageResourceStyleImage will be created and attached to the RenderImage. 11 RenderImageResourceStyleImage::m_cachedImage will be set to null at the 12 beginning because the m_styleImage->isCachedImage() is false in this case. 13 When ImageLoader finishes loading the url of the src attribute, 14 RenderImageResource::setCachedImage() will be called to set m_cachedImage. 15 16 A crash will happen when the RenderImage is destroyed. Destroying the 17 RenderImage calls RenderImageResourceStyleImage::shutdown() which checks 18 m_cachedImage and finds it not null, so it calls RenderImageResourceStyleImage::image() 19 which ends up calling CSSNamedImageValue::image() which returns a null pointer 20 because the size is empty. RenderImageResourceStyleImage::shutdown() calls 21 image()->stopAnimation() without checking the return value of image(). 22 23 Another crash will happen later when deleting the CachedImage from the memory 24 cache if CachedImage::canDestroyDecodedData() is called because the client 25 it gets from m_clients is a freed pointer. This happens because RenderImageResourceStyleImage 26 has m_styleImage of type StyleGeneratedImage but its m_cachedImage is set 27 by RenderImageResource::setCachedImage(). When RenderImageResourceStyleImage::shutdown() 28 is called, it calls StyleGeneratedImage::removeClient() which does not 29 know anything about RenderImageResourceStyleImage::m_cachedImage. So we 30 end up having a freed pointer in the m_clients of the CachedImage. 31 32 Test: fast/images/image-element-image-content-data.html 33 34 * rendering/RenderImageResourceStyleImage.cpp: 35 (WebCore::RenderImageResourceStyleImage::shutdown): Revert back the changes 36 of r208511 in this function. Add a call to image()->stopAnimation() without 37 checking the return of image() since it will return the nullImage() if 38 the image not available. There is no need to check m_cachedImage before 39 calling image() because image() does not check or access m_cachedImage. 40 41 If m_styleImage is not a CachedStyleImage but m_cachedImage is not null, 42 we need to remove m_renderer from the set of the clients of this m_cachedImage. 43 44 (WebCore::RenderImageResourceStyleImage::image const): The base class method 45 RenderImageResource::image() returns the nullImage() if the image not 46 available. This is because CachedImage::imageForRenderer() returns 47 the nullImage() if the image is not available; see CachedImage.h. We should 48 do the same for the derived class for consistency. 49 1 50 2017-08-04 Jeremy Jones <jeremyj@apple.com> 2 51 -
trunk/Source/WebCore/rendering/RenderImageResourceStyleImage.cpp
r220073 r220289 57 57 { 58 58 ASSERT(m_renderer); 59 image()->stopAnimation(); 59 60 m_styleImage->removeClient(m_renderer); 60 if (m_cachedImage) { 61 image()->stopAnimation(); 62 m_cachedImage = nullptr; 63 } 61 if (!m_styleImage->isCachedImage() && m_cachedImage) 62 m_cachedImage->removeClient(*m_renderer); 63 m_cachedImage = nullptr; 64 64 } 65 65 … … 67 67 { 68 68 // Generated content may trigger calls to image() while we're still pending, don't assert but gracefully exit. 69 return !m_styleImage->isPending() ? m_styleImage->image(m_renderer, size) : &Image::nullImage(); 69 if (m_styleImage->isPending()) 70 return &Image::nullImage(); 71 if (auto image = m_styleImage->image(m_renderer, size)) 72 return image; 73 return &Image::nullImage(); 70 74 } 71 75
Note: See TracChangeset
for help on using the changeset viewer.